Acceptable use

Your platform runs your customers' code on your servers: you are its host, and your providers' terms (Hetzner's, Cloudflare's) apply to everything it runs. Show your customers an acceptable-use policy, with your own abuse contact. This one is a starting point.

A policy for your customers

Apps may not:

• host or link to malware, phishing, or pages imitating another service to collect credentials;
• send spam or unsolicited bulk messages (outbound mail ports are closed to tenant apps);
• attack, scan or probe other systems, or try to get around the sandbox, its limits or other tenants' isolation;
• mine cryptocurrency, or otherwise keep the CPU busy for work their users didn't ask for;
• infringe copyright or trademarks, or host content that is illegal where the servers are;
• host content that sexualizes minors, promotes violence or terrorism, or harasses people.

Apps that break these rules are suspended, without notice when they harm others (phishing, malware, attacks), and removed if it happens again.

Handling abuse

• Reports to the cluster file's [alerts] abuse address are received by Resend, matched to the tenants' apps and domains they name, kept, and emailed to your [alerts] recipients. Your dashboard's Abuse page lists them, each with the tenants it names and a button to suspend them.
• Suspending a tenant (POST /tenants/<tenant>/suspend) takes all its apps down at once: they answer 503 and never wake until you resume it. Nothing of its data is deleted.
• A busy CPU suspends a tenant by itself: an app at 90% or more of its CPU for 30 minutes in a row, and you are told (tenant.suspended, reason cpu; see Limits).